security: remove exposed credentials and patch dependencies

.env.example

@@ -0,0 +1,5 @@
+# Server-only credentials. Configure these in `.env.local` for local
+# development and in the deployment provider's encrypted environment settings
+# for production. Never commit real values.
+DEEPSEEK_API_KEY=replace-with-your-siliconflow-api-key
+ARK_API_KEY=replace-with-your-volcengine-ark-api-key

.github/workflows/ci.yml

@@ -0,0 +1,40 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+      - "security/**"
+      - "portfolio/**"
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: "22"
+          package-manager-cache: false
+
+      - name: Install locked dependencies
+        run: corepack pnpm@8.15.6 install --frozen-lockfile
+
+      - name: Audit production dependencies
+        run: corepack pnpm@8.15.6 audit --prod
+
+      - name: Type-check
+        run: corepack pnpm@8.15.6 exec tsc --noEmit
+
+      - name: Build production application
+        env:
+          ARK_API_KEY: ci-placeholder
+          DEEPSEEK_API_KEY: ci-placeholder
+        run: corepack pnpm@8.15.6 build

.gitignore

@@ -27,6 +27,7 @@ yarn-error.log*
 # local env files
 .env
 .env*.local
+.history/
 
 # vercel
 .vercel
@@ -35,4 +36,4 @@ yarn-error.log*
 *.tsbuildinfo
 next-env.d.ts
 
-.history
+.history